The normal Tailscale Docker app is convenient, but a containerized VPN does not always behave like Tailscale installed directly on a Linux host. The source author wanted a first-class host daemon with a real TUN device so ZimaOS itself could act as a subnet router or exit node and mount resources reachable through the tailnet.
Because ZimaOS has an appliance-style read-only root and no conventional apt install tailscale path, the author packaged Tailscale as a systemd-sysext extension. This is a community project, not an IceWhale-supported Tailscale package, so its commands and lifecycle should be labeled accordingly.
Why Run Tailscale on the Host?
The source author described Docker userspace networking as good enough for ordinary connectivity but awkward for host-level routing. A native daemon can use the kernel TUN device directly and integrate with systemctl, IP forwarding, subnet routes, and exit-node behavior.
Why systemd-sysext Fits ZimaOS
systemd-sysext overlays additional files into locations such as /usr at runtime without modifying the immutable base image. The author mirrored Tailscale's upstream Buildroot layout and stored persistent authentication state under /DATA/AppData/tailscale/.
The Project Provides a Host Install Script
The community repository's quick-start flow clones the project, runs its installer with sudo, then authenticates with tailscale up. Because this is third-party code running as root, review the repository and release history before execution.
Read the current sysext project and its maintained installation notes rather than copying an old forum version.
Authentication State Lives Outside the Disposable Extension
The project keeps node state under /DATA/AppData/tailscale/. That allows the Tailscale identity to survive rebuilding or replacing the .raw sysext file.
A Real Reboot Bug Was Found After the Initial Release
A user reported that tailscaled did not start after reboot. The project author reproduced it and explained the race: multi-user.target resolved service dependencies before systemd-sysext.service had merged the extension, so the service unit did not exist at the moment systemd built the target.
v1.0.1 Added a Watchdog Timer
The author fixed the boot race with a small timer and oneshot service stored on the persistent root under /etc/systemd/system/. It runs shortly after boot and starts tailscaled once the sysext overlay is present.
The source author reported verifying the fix on a real reboot.
IP Forwarding Settings Were a Separate Persistence Question
The thread also asked whether subnet-router sysctl settings survive restart. The author explained that ZimaOS persists /etc through an overlay backed by persistent storage, so configuration under /etc/sysctl.d/ survives and is re-applied.
Those forwarding settings are needed for subnet-router or exit-node use, not for an ordinary Tailscale client.
The IPv6 Limitation Changed with the ZimaOS Kernel
The original May 2026 module documented missing IPv6 policy-routing kernel options on ZimaOS 1.6.1/kernel 6.12.25, which caused Tailscale to disable tunneled IPv6.
By July 30, the author updated the thread because IceWhale's newer kernel supplied the required IPv6 capabilities. The current project repository verifies IPv6 tailnet operation on ZimaOS 1.7.0/kernel 6.18.9.
Re-Run the Installer After ZimaOS Updates
The project is designed to rebuild the sysext from official Tailscale static binaries and preserve the auth state separately. The repository currently recommends re-running the installer after a ZimaOS upgrade.
Treat a Root-Level Community Module as System Software
This module runs directly on the NAS host and its installer has elevated privileges. Review source, hashes, update behavior, and uninstall behavior before deploying it on a system that holds important data.
The Project Was Re-Verified on ZimaOS 1.7.0
The current repository reports a clean end-to-end test on ZimaOS 1.7.0 with kernel 6.18.9, including reboot persistence and working tailnet IPv6. That is stronger evidence than the original May 2026 post, which was developed against ZimaOS 1.6.1.
Docker and Native sysext Solve Different Needs
If you only need selected applications reachable over Tailscale, the Docker route can be simpler and keeps host modifications minimal. The sysext route is attractive when the ZimaOS host itself needs to mount tailnet resources, advertise LAN subnets, or act as an exit node.
Do not replace a working Docker installation merely because the native approach exists. Choose based on whether host-level routing is actually required.
Uninstall and Purge Are Different Operations
The community project deliberately separates removing the sysext from deleting Tailscale state. Its normal uninstall path can keep the persistent node data, while a purge removes the state directory as well. That distinction matters if you intend to reinstall without creating another tailnet identity.
The Boot Watchdog Is Still Part of the Design
The current project documentation says the watchdog remains needed even on ZimaOS 1.7.0 because the service unit inside the sysext can still miss the initial systemd target assembly. The newer kernel fixed IPv6 capability, not the sysext service-order race.
Native Tailscale FAQ
Is this an official IceWhale Tailscale package?
No. It is a community systemd-sysext project.
Why use it instead of Docker?
The project targets host-level TUN, subnet-router, exit-node, and normal systemd integration.
Was the reboot-start problem fixed?
The project author reproduced it and released a watchdog-based fix in v1.0.1.
Does IPv6 still have the 1.6.1 limitation?
The project reports that the newer 6.18.9 kernel used by ZimaOS 1.7.0 supplies the required IPv6 policy-routing support.
